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1.1 Introduction 

The problem of decoherence is an integral part of the theory of quantum 
computation and communication. The potential of a quantum computer lies 
in its ability to process information in the form of a coherent superposition 
of quantum mechanical states. Quantum algorithms such as Shor's algorithm 

make use of the interference of different "computational paths", which 
can strongly enhance their efficiency compared to classical algorithms. Be- 
cause quantum coherence and interference play a central role in a quantum 
computer, decoherence is a major threat to its proper functioning. 

A similar situation prevails in quantum communication. The central prob- 
lem of quantum communication is how to faithfully transmit unknown quan- 
tum states through a noisy quantum channel. While quantum information 
is sent through a channel such as an optical fiber, the carriers of the infor- 
mation (e.g. photons) interact with the channel and get entangled with its 
many degrees of freedom, which gives rise to the phenomenon of decoherence 
on the state space of the information carriers. An intially pure state becomes 
a mixed state when it leaves the channel. For quantum communication pur- 
poses, it is however essential that the transmitted qubits retain their genuine 
quantum properties, for example in form of an entanglement with qubits on 
the other side of the channel. 

To deal with the problem of decoherence, two methods have been de- 
veloped, known as quantum error correction [^jj^,^ and entanglement purifi- 
cation |^,^j7j, respectively In quantum error correction, which will be dis- 
cussed in the next section, quantum information is encoded in the joint state 
of several two-state particles, forming a so-called quantum error correcting 
code, before it is sent through the channel. By measuring certain joint ob- 
servables of the particles (the so-called stabilizer of the code), it is thereby 
possible to "reset" the state of the information carriers after a given time, 
by projecting their joint state onto certain subspaces of their Hilbert space 
without destroying the coherence of the encoded information. Even though 
quantum error correction can be used, in principle, to send quantum infor- 
mation through a noisy channel, it has been primarily developed to stabilize 
a quantum computer against the effect of decoherence. Entanglement pu- 
rification, on the other hand, together with the method of tclcportation Q, 
is a powerful tool that is particularly suitable for quantum communication. 
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The idea of entanglement purification is to "distill" from an ensemble of low- 
fidelity Einstein-Podolsky- Rosen (EPR) Q pairs, which have been distributed 
through some noisy channel, a smaller ensemble of high-fidelity EPR pairs 
which may then be used for faithful teleportation |^ or for quantum cryp- 
tography px| , pl| . This distillation process requires certain unitary operations 
and measurements to be performed on the qubits at each side of the channel, 
and a process of postselection, which also requires classical communication 
between the parties. 

Both methods, quantum error correction and entanglement purification, 
fight decoherence by a process of controlled disentanglement of the informa- 
tion carriers from the quantum channel. This process involves the action of 
some apparatus that is used to transform and measure the state of the parti- 
cles, for example via tunable interactions of the particles with each other and 
with external fields. Real apparatuses are themselves sources of noise, which 
complicates the situation considerably. From a general perspective, the appa- 
ratuses used by Alice and Bob must themselves be considered as part of the 
noisy communication channel. Under realistic circumstances, the information 
carriers will thus always become entangled with other degrees of freedom and 
therefore suffer from a certain amount of decoherence. The question is there- 
fore not whether decoherence can be avoided at all, but whether its influence 
can be kept on a tolerable level. 

What "tolerable" means depends on the context. In quantum computa- 
tion, for example, the effect of decoherence may be tolerable as long as the 
fidelity of the output of a quantum algorithm is above a certain value, allow- 
ing one to extract the desired result with the corresponding probability. In 
quantum cryptography the effect of the channel cannot, in principle, be dis- 
tinguished from an intelligent third party who manipulates the transmitted 
quantum systems to gain information about their state. All noise of a channel 
is therefore attributed — this is the pessimistic attitude of the cryptologist 
— to an adversary. Decoherence is thereby considered due to entanglement 
of the information carriers with degrees of freedom controlled by an adver- 
sary. As we will show in the later part of this review, the security of quantum 
cryptography is in fact closely connected to the disentanglement of the de- 
grees of freedom of the information carriers, on one side, and the channel, 
on the other side. Even though we cannot avoid all residual entanglement 
with the channel, we can distinguish between residual entanglement with the 
apparatus, which is harmless, and residual entanglement with the part of the 
channel accessible to an eavesdropper, which is potentially harmful. 

In the following, we will give a brief introduction to the methods of quan- 
tum error correction and entanglement purification, and to the basic proto- 
cols of quantum cryptography.^ We will then discuss a recent security proof 
for cntanglcmcnt-bascd quantum communication through noisy chan- 

^ For a more comprehensive introduction into these fields of quantum information 
theory, see, for example, Ref. |J12|. 
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nels, which exphcitly takes into account the role of noisy apparatus. We try 
to pay particular attention to conceptual issues but skip some of the technical 
details, which can be found in the literature. 



1.2 Quantum Error Correction 

Quantum mechanical entanglement is exploited in quantum algorithms and in 
many protocols for quantum communication such as telcportation or entang- 
lement-based quantum key distribution. It also plays a fundamental role in 
quantum error correction, where the coding operations are themselves simple 
quantum algorithms. Let us illustrate the basic principles at the example of 
the first quantum error correcting code found by Peter Shor in 1995 To 
protect quantum information that is represented by the state of a particle 



(central qubit in Fig. 1.1) against decoherence, the information is first dis- 
tributed or delocalized over several particles. In Fig. this is done with the 
help of the network ENC , which realizes the following mapping: 

ENC: (a|0)+/3|l))|0)|0)---|0)^a|0)s+/3|l)s (l-l) 
in which the states 

|0)s = 2"3/2(|000) + |111))(|000) + |111))(|000) + |111)) 
\l)s = 2-3/2(1000) - |111))(|000) - |111))(|000) - |111)) . (1.2) 

denote the so-called code words of the (9-bit) Shor code . The encoding trans- 
formation thus corresponds to an embedding 7Y 9 |0) = a|0) -I- /3|1) i — > 
a\Q)s + /3|l)s = \(j))s € T^S C of the two-dimensional Hilbert space 

7i ~ of the central qubit into the higher-dimensional Hilbert space of 
all 9 qubits. After the transformation the quantum information lies in a 
two-dimensional subspace Tis of a 2^ dimensional Hilbert space. The code 
words 10)5 and [1)5 are tensor products of entangled threc-qubit states of the 
form 1 000) ± |111), the so-called Greenberger-Horne-Zeilinger (GHZ) states 
, which play a prominent role for the interpretation of quantum mechan- 
ics. |lj,15). One can easily check that after the encoding (see dotted line in 
Fig. lA) the reduced density operator of each of the qubits is totally mixed; 
that is, the individual state of the particles carries no information about |0).0 

^ Quantum error correcting codes are indeed constructed in such a way that the 
state of individual qubits in a codeword becomes completely undetermined. As 
was shown by DiVincenzo and Peres , the codewords satisfy generalized Mer- 
min relations that exclude the possibility of consistently assigning a predeter- 
mined value to complementary observables of each qubit. From the measurement 
of an individual qubit one can thus not gain any information about In the 
positive sense this means that an uncontrolled interaction of the environment 
with one of the qubits does not (necessarily) lead to an irreversible loss of infor- 
mation. 
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Fig. 1.1. Quantum logic network of the Shor code and quantum error correction. A 
"random rotation" a^.j on qubit j in the encoded state translates into a certain "er- 
ror syndrome" ei, . . . , eg and a corresponding unitary operation U — U{ei, . . . ,es) 
on the central qubit (see text). The network uses the Hadamard-Rotation Rj = 
1/V2{a^,j + a,,j) and the CNOT gate (J= CNOT.j = + i^^o",,,). 



For simplicity let us consider an error model where random rotations are 
applied to the individual qubits with a certain "error rate". This model is 
more general than it appears to be at first sight but it needs a justification 
to which wc shall return below. Suppose that, after the encoding circuit of 



Fig. 1.1, one of the four Pauli-Rotations cr^.j {fi = 0, 1, 2, 3) is applied to one 
of the nine qubits, where both j and ^ are random and unknown to us. The 
question is this: Can we still extract \(j>) from the joint state of the particles? 
If such a random rotation is applied to the particle before the encoding, it is 
clear that the information is lost, for ^ "'mI'^) ('^I'^^m ~ applied 
to one of the particles of the encoded state, however, the information can 
still be rescued fr om the joint state of all 9 particles. A possibility to do this 
is shown in Fig. |l.l| . There the inverse network of ENC is applied to the 
code which transforms the corrupt state cr^i,j|(/>)s, for arbitrary (Jfi.j, back to 
a product state: 

ENC-^: |</>')|ei)|e2>...|e8>. (1-3) 

After this decoding transformation, the state of the neighboring qubits carries 
the so-called error syndrome ei...e^. The central qubit is in state \4>') = 
U{ei . . .es)\(f>), where the unitary transformation [/(ei . . . eg) G {I, CTj;, o-y, CTz}, 
is uniquely determined by the error syndrome. 

By reading off the error syndrome, i.e. measuring the state of all neighbor- 
ing qubits, and subsequently applying the correction operation U~^{ei . . . eg), 
the central qubit is transformed back to its initial state. Please note that the 
central qubit remains unmeasured, and no information about the state is 
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obtained at any step of the protocol. By iteration of the sequence decoding 
— > syndrome measurement & correction — > encoding [ pTf an unknown quan- 
tum state can thus be protected against decoherence over a time significantly 
longer than the decoherence time. 

The effect of the random rotations cr^j is to map the code space Hs to 
a set of orthogonal error spaces a^.jTi.s-^'Hs- The images of the code words 
thereby satisfy the following orthogonality relations s{^W^I.,j'^u,k\^)s = and 
sJM£^l.,j<^v,k\^) S = {^(^^l,j(^v,k\^)s for all j,k,iJL,v. Theses relations ensure 
[|6|Jlq], that all errors (t^j- can, in fact, be corrected. The Shor code was 
the first quantum error correcting code found that can correct all of the 
four errors (spin flip, phase flip, spin&phasc flip, identity) on any one of the 
qubits. Independent of Shor, Steane Q found a code that achieves the same 
task using only 7 qubits. Later, the theory of quantum error correcting codes 
was further developed |^,|l9|, establishing in particular the connection with 
classical coding theory. A number of other codes were found, among them a 
so-called 'perfect' code using a minimum number of only 5 qubits [0^. One 
can also construct codes that are able to correct more than a single qubit 
error. These satisfy a similar set of orthogonality relations of the form given 
above, and the code words are entangled states of an increasing number of 
qubits. An introduction to the theory of quantum error correction can be 
found in the articles by Steane [ pOpH and by Gottcsman |2^, for example. 

In quantum error correction we exploit, as in quantum algorithms, the 
possibility to manipulate superpositions of states of a quantum register and 
to measure joint observables which describe joint properties of several qubits. 
The operation ENC^^ for example, followed by one-qubit measurements, 
corresponds to the measurement of the "parity" of different qubits, as was 
shown by Gottcsman The joint observables arc herc^ 
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The error spaces o^^jTis are eigenspaces of these observables with eigenvalues 
±1. The observable Mi = CTz,iO'z,2, for example, tells us whether on qubit 1 
or 2 a spin flip has occurred without revealing any information on which 
of the qubits: Mi(|000) + |111)) = +(|000) + Mi(|100) -I- |011)) = 

^ These observables generate an Abelian group, the so-called stabilizer of the Shor 
code Q. 
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-(|100) + |011)), Mi(|010) + |101)) = -(|010) + |101)). By measuring both 
observables Mi = az,i(Jz,2 and M2 = (yz,2'^z,3 one can find out whether, and 
on which of the qubits 1,2 ,3a spin flip has taken place. 

The measurement of the eigenvalues of these joint observables can be re- 



alized, as described in Fig. 1.1, by the method "decode and subsequently 
measure the individual state of the surrounding qubits" . This strategy has 
the disadvantage that the decoding leaves the logical qubit in an unpro- 
tected state, exposing it directly to the influence of dccoherencc. There are 
different methods (or networks, respectively) which use so-called ancillas to 
perform the error detection and correction on the encoded state directly. This 
is the subject of fault-tolerant quantum error correction and, more generally, 
fault-tolerant quantum computation. It takes into account the fact that the 
elementary operations which are part of the encoding and decoding network 
may themselves be imperfect and subject to errors. Thus one needs to make 
sure that the correction operations do not introduce more errors into the sys- 
tem than they extract. A description of the theory of fault- tolerant quantum 
computation is beyond the scope of this introduction. A central result states 
that it is possible, by using concatenated encoding strategies, to maintain 
the coherence of the logical state of a quantum computer over an arbitrarily 
long time, given that the error probability (noise level) of the elementary 
operations (quantum gate, measurement) is below a certain threshold. The 
price one has to pay for this is a certain overhead in the number of auxiliary 
(physical) qubits that scales polynomially [or under certain circumstances 
even polylogarithmically] with the time of computation. The threshold is 
very small and of the order of 10^'' — 10^^. The theory of fault-tolerant com- 
putation is considered as the general solution of the problem of decolierence 
and imperfect apparatus for quantum computation. An introduction into the 
subject is given by Prcskill |Q, for example. 

What is an Error? Let us return to the question whether the model of an 
error as a random unitary rotation is reasonable. The interaction of the qubits 
with the environment can be described as a unitary evolution in the Hilbert 
space of the total system consisting of both the qubits and the environment. 
Where and in what sense do "errors" happen in this picture? This question is 
certainly justified. One can show, however, that any interaction of the qubits 
and the environment can be written in the (integrated) form 

\^)s\u)env -> Y.^Fk\^^s)\uk)on. (1-5) 
fe 

where the operators Fk are tensor products of Pauli operators and |Mfc)env 
states of the environment which in general are neither orthogonal nor nor- 
malized This result remains true if is replaced by an arbitrary 
multi-qubit state ||2l[. In case of a quantum error correcting code, such as 
the Shor code, one has the additional property that s{4'\Fk^^^\<P)s = 0, for all 
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"1-bit operations" -F^l^'''* which contain a non-trivial PauU operator only at a 
single position (that is, for F^^''^ I (g) • • • (g) I (g) (g) I (g) • • • I). For weak 
interactions and for uncorrelated noise, these are the terms of first order in 
an expansion with respect to the interaction strength. Since the overall evolu- 
tion on the space of the qubits plus the environment is unitary, the picture of 
randomly occurring errors, which arc subsequently corrected, is only a helpful 
way of thinking about the problem. The "digitalization of noise" is in 
fact only introduced via the measure men t of certain observables such as the 
Mfc. By measuring the Mk the state (L5) of the system is projected "back" 
into the code space Hs or any of the error spaces F^^^^Hs-i-'Hs that are or- 
thogonal to it. It is the disentanglement of the qubits from the environment 
which is the crucial process. The "error" is introduced by the fact that one 
does not always project back to the code space but sometimes also into an 
orthogonal error space, so that subsequently a unitary correction operation 
has to be applied to rotate the state back into the code space. On the Hilbcrt 
space of the qubits alone, the entire process can effectively be described as if 
the environment would apply random rotations cr^^ on the code, which we 
then check and possibly correct. Similar remarks apply to codes that correct 
several errors at the same time, which take into account terms of higher order 
in the expansion ([L5|). 



1.3 Entanglement Purification 

In quantum communication, entanglement between distant parties plays a 
predominant role. In the following, we will concentrate on communication 
scenarios which involve two parties, Alice and Bob. What does it mean when 
we say that Alice and Bob have entanglement at their disposal? Usually, 
this means that they own quantum systems whose state is entangled, or, 
in technical terms, that the density operator which describes the state of 
the two quantum systems cannot be written as a convex combination of 
product states j2^. The two entangled quantum systems are usually called 
EPR pairs, due to the famous paper by Einstein, Podolsky and Rosen [||. In 
the context of quantum information theory, the EPR pairs often consist of 
two entangled two- level systems (qubits) , one owned by Alice, and the other 
by Bob. Maximally entangled two-qubit states are called Bell states; one can 
find four orthogonal Bell states, which form a basis of the two-qubit Hilbcrt 
space, the Bell basis. 

The importance of entanglement is due to the fact that it is a resource 
which is equivalent to a quantum channel: If Alice and Bob are connected 
with a quantum channel, Alice can create an EPR pair locally and send one 
half through the quantum channel to Bob. On the other hand, if Alice and 
Bob own EPR pairs, they can use them to teleport qubits even when they 
are not connected via some "real" quantum channel like an optical fiber. 
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The questions remains however, how can Ahce and Bob obtain perfect 
EPR pairs if they can only communicate via a noisy channel? Any real quan- 
tum channel interacts with the quantum systems which are sent through it: it 
becomes entangled with them. This fact is important if Alice uses the channel 
in order to distribute EPR pairs. If the EPR pairs are subsequently used for 
teleportation. then the telcported qubits become entangled with the quantum 
channel. 

Entanglement purification protocols [^|J^,01 can be used to overcome this 
problem. Simply speaking, these protocols create an ensemble of highly en- 
tangled pairs out of a larger ensemble of pairs with low fidelity. The fidelity 
of a quantum state p is defined as its overlap with a given Bell state {"P^), 
say, i. e. F = p |^+). 

The purified pairs provide Alice and Bob with a purified quantum tele- 
portation channel. If this channel is used for quantum communication, the 
qubits are protected against an unwanted interaction with the channel. In 
the next sections, we will see that this fact can be exploited for quantum 
cryptography protocols. 

In order to perform an entanglement purification protocol, classical com- 
munication between Alice and Bob is necessary. This means, that both Alice 
and Bob perform measurements on their respective qubits, and tell each other 
the measurement outcomes. For some protocols only one-way communication 
is required, i. e. only Alice will send classical messages to Bob. It has been 
shown by Bennett et al. that these one-way entanglement purification 
protocols are equivalent to quantum error correcting codes (see Section 1.2). 

A tutorial introduction to the basic idea of entanglement purification is 
given in Ref. 



1.3.1 2-Way Entanglement Purification Protocols 

The two-way entanglement purification protocols (2-EPP) which we present 
here have been developed by Bennett et al. ^ and, later, by Deutsch et al. 
. Since these protocols work in recursive way, they are often referred to as 
recurrence protocols. In order to distinguish between both protocols, we will 
call them IBM and Oxford protocol, respectively. The IBM protocol intro- 
duces a twirling operation after each purification step, which transforms the 
state of the EPR pairs into the Werner form. Since Werner states are de- 
scribed by only one real parameter, all calculations can be done analytically. 
A disadvantage of the IBM protocol is that it is less efficient in producing 
pure states from noisy ones than the Oxford protocol. Qualitatively, there is 
no difference between both protocols. 

To be precise, we want to distinguish between the purification protocol 



and the distillation process (see Fig. 1.2) 



In each step, the purification protocol acts on two pairs of qubits. For the 
sake of simplicity, we shall assume that these two pairs are described by the 
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Round Round 1 Round 2 Round 3 



(a) (b) 

Fig. 1.2. (a) The entanglement purification protocol is a (probabilistic) protocol, 
which creates a higher entangled pair of qubits out of two pairs with lower entangle- 
ment. Usually these pairs are called source and target pair, respectively. Through an 
interaction between the qubits of the source and the target pair, realizing a so-called 
CNOT operation on each side, the states of all four qubits become correlated. By 
measuring the qubits of the target pair, the source pair is probabilistically projected 
into a new state p'abi which is more entangled than the original state pAfl.(b) The 
distillation process consists of several rounds. In each round, the pairs are combined 
into groups of two at a time, and the purification protocol is applied to them. From 
round to round, the entanglement of the remaining pairs is increased. 



density operator pab ® Pab, which is thus a four-qubit density operator. The 



Oxford protocol (see Fig. 1.2) consist of the following steps: 



1. Alice and Bob perform one-qubit 7r/4 rotations about the x-axis on 
each of their qubits (in opposite directions). If the qubits were stored in 
atomic/ionic degrees of freedom inside a trap, this could be implemented 
by (simple) laser pulses. 

2. Both Ahce and Bob perform a CNOT-operation (controlled NOT) Q, 
where they use their respective particle of pair one (two) as the source 
(target). This is the part of the protocol which is most difficult to perform 
exp er iment ally. 

3. Finally, both Alice and Bob measure the qubits which belong to pair two 
in the (Tz-basis, and tell each other the results (two-way communication). 
Whenever the results coincide, the keep pair one, otherwise they discard 
it. In either case, they have to discard the second pair, because it is 
projected onto a product state by the measurement. 

In order to see how this protocol works, it is useful to write the density 
matrices in the Bell basis, i. e. in the basis of the two qubit Hilbert space, 
which consists of the four BeU states \<P^) = 1/V2 (|00) ± |11)) and li^-*) = 
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1/V2(|01)±|10)): 

off — diag. 



PAB = A|<?+)(<?+| +B\I'-){^-\ +C|tf+)(i^'+| +D\^-){$- 



elements 
(1.6) 



The coefficients A, B, C, and D are called the Bell diagonal elements of the 
density matrix pab- For any physical state, these coefficients have to fulfill 
the normalization condition tr pab = A + B + C + D = 1. 

As it turns out, the Bell diagonal elements A\B' , C and D' of the remain- 
ing pair do not depend on the off-diagonal elements of pab- For this reason, 
we can find a recurrence relation for the Bell diagonal elements, which de- 
scribes their evolution during the distillation process (the index n belongs to 
the state of the pairs at the beginning of round number n in the distillation 
process: 

+ Bf^ _ 2CnDn 
An+l - , - 

2 2 

Cn+1 - , - ^ 

The normalization Nn — {An + BnY + (C„ + -D„)^ is equal to the probability 
Psucccss, that Alice and Bob obtain the same measurement results in step 3 of 
the protocol. Even though no analytical solution has been found for this re- 
currence relation, it has been shown (numerically in [Q and later analytically 
[|7|) that it converges to the fixpoint = 1, = C°° = 1?°^ = 0, when- 
ever the initial fidelity is greater than 1/2. In this case, also the off-diagonal 
elements will vanish, since the density matrix has to be positive. In other 
words, whenever Alice and Bob are supplied with EPR pairs with a fidelity 
of more than 50%, they can distill (asymptotically) perfect EPR pairs. 

For the IBM protocol, one only needs one recurrence relation, since (one- 
parametric) Werner states, described by A = F, B~C = D= (1 — F)/3 
and vanishing off-diagonal elements in ( |l.6| ), are mapped onto Werner states. 



This map is shown in Fig. (1.3a). The map has tree fixpoints. Two of these 
fixpoints are attractive (at F = 1/4 and F = 1), and the remaining one 
(at F = 1/2) is repulsive. Thus, if one starts the distillation process with a 
fidelity greater than 1/2, one will finally reach EPR pairs in a pure state. If 
the initial fidelity is smaller than 1/2, one will finally be left with completely 
depolarized pairs, which correspond to a Werner state with a fidelity of 1/4. 



1.3.2 Purification witii Imperfect Apparatus 

Up to now, we have assumed that the only source of decoherence is the quan- 
tum channel which connects Alice and Bob. For practical implementations, 
however, this is an over-simplification. Indeed, there are many operations in- 
volved in the distillation process: Qubits have to be stored for a certain time. 
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Fig. 1.3. The purification curve for tfie IBM protocol ||5||6| for perfect (i. e. noiseless) 
apparatus (a). The staircase denotes how the fidelity increases from round to round 
in the distillation process of Fig. [l.3|b) . If the apparatus is imperfect, the purification 
curve is "pulled down" (b) and the fixpoints move towards each other. The upper 
fixpoint of the curves indicates the maximum achievable fidelity -Fmax, which can 
be reached asymptotically by the respective purification protocols; Fmax decreases 
with an increasing noise level. Attractive fixpoints are denoted by black circles, 
repulsive fixpoints by white circles. 
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one- and two-qubit unitary operations will act on them, and there are mea- 
surements. Each of these operations is a source of noise by itself. It would be 
inconsistent to ignore this source of noise. So the following question arises: 
What are the conditions which we have to impose on the apparatus so that 
entanglement distillation works at all? 

As we have mentioned in the context of fault tolerant quantum compu- 
tation, there exists a certain noise threshold for the elementary operations, 
below which fault tolerant quantum computation is possible. In the case of 2- 
EPP we will find a threshold which is much more favorable than the threshold 
for fault tolerant quantum computation. 

In order to get a qualitative understanding of the influence of noisy opera- 
tion on the entanglement distillation process, we look again at the purification 
curve (Fig. (^|^)). The curve shows how the fidelity after a purification step 
depends on the previous fidelity. If noise is introduced in the purification pro- 
cess itself, it is intuitively clear that only a smaller increase in fidelity can be 
achieved: the purification curve is "pulled down" . In Fig. ( |l.3| b) this is shown 
schematically. We thus expect that in the case of noisy operations, one has 
to start with a greater initial fidelity in order to purify at all, and that the 
maximum fidelity which can be reached will be smaller than unity. 

If the noise level is increased, one reaches the situation that two of the 
fixpoints will merge. At even higher noise levels, the purification curve has 
only the trivial fixpoint which corresponds to completely depolarized pairs: 
the distillation process breaks down and does not work any longer. 

The quantitative investigation of entanglement purification with noisy ap- 
paratus shows that the above considerations are qualitatively correct. 
For the calculation, the following noise model has been assumed [ p9[ : 

• The unitary evolution of the qubits is accompanied by a depolarizing 
channel. It is well-known that this can be written in a time-integrated 
form 

PAB ^ P UaPAbU^^ -\ —lA<^trAPAB- (1-8) 

Here, pab is the density operator which describes the state of a bipartite 
quantum system, Ua is the desired unitary operation (which is assumed 
to act only on the quantum system at party A), d is the dimension of 
the Hilbert space of A's system, and p is the reliability of the quantum 
operation. For p = 1, there is no noise at all, and for p = 0, the quantum 
system at A becomes completely depolarized. 

• Measurements give the correct results only with a certain probability 77. 
This can be conveniently described in terms of a POVM (positive operator 
valued measure [0), 



A/o-r;|0)(0| + (l-r7)|l)(l| 
A/i = ,7|l>(l| + (l-,,)|0>(0|, 



(1.9) 
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for one-qubit measurements in the cr^ basis. Here, tr(Mjp) describes the 
probabiUty with which the detector indicates the result "j" for the mea- 
sured qubit. 



As one can see from Eq. (1.8), we have to distinguish between one- and 
two-qubit operations, if they are accompanied by noise: a two-qubit depolar- 
izing channel is different from two one-qubit depolarizing channels. The first 
is an example of a correlated noise channel, the latter of an uncorrelated noise 
channel. The reliability of one- and two-qubit operations is referred to as pi 
and p2, respectively. Whether or not entanglement purification is possible 
with a certain protocol, depends on the three parameters pi,P2, and 77. For 
all these parameters, one gets a noise threshold in the percent regime, which 
is about two orders of magnitude better than the noise threshold for fault 
tolerant quantum computation. 



1.4 Quantum Cryptography 

One of the practically most advanced fields in quantum communication is 
quantum cryptography. In this section, we will describe the two basic proto- 
cols of quantum cryptography. We show that decoherence in the (untrusted) 
quantum channel as well as in the (trusted) apparatus plays an important 
role in the security analysis of quantum cryptography protocols. 

The communication scenario in the cryptographic context looks as fol- 
lows: Alice wants to send a confidential message (clear-text) to Bob, while 
a third communication party. Eve. wants to listen in and learn as much as 
possible about the message. In order to achieve her goal, Alice encrypts the 
message using some cryptographic method. The encrypted message is called 
ciphertext. A cryptographic protocol is considered good, if it is possible to 
restrict the information which Eve can obtain to any desired level. 

There exist several categories of classical cryptographic protocols; these 
include symmetric key ciphers, asymmetric key ciphers and one-time pads. 
All these protocols have advantages and disadvantages, but the most eminent 
advantage of the one-time pad is that it has been proved to be secure in the 
information theoretical sense: one can show that an eavesdropper can gain 
no information (zero bits of information) about the message, even if he or she 
knows every single bit of the encrypted message. To this end, it is however 
necessary that Alice and Bob share a secret and random key, which must at 
least be as long as the message which Alice wants to transmit, and that this 
key will only be used once (thus the name one-time pad). 

The one-time pad works as follows: As a key, Alice and Bob share a 
secret string of zeros and ones s = [si, S2, ■ ■ ■ , sn). Similarly, Alice can write 
the clear-text (like any piece of information) as a string of zeros and ones, 
using some encoding which Alice and Bob agree on publicly. The clear-text is 
thus given in a binary representation t ~ {ti,t2, ■ ■ ■ , iw). For the ciphertext, 
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Alice adds the key and the clear-text bitwise modulo 2: c = (si ii, S2 © 
t2, ■ ■ ■ , Sat © In). In order to decrypt the message, Bob simply adds the key 
bitwise (modulo 2) to the ciphertext, and gets back the binary representation 
of the clear-text. 

The key used in the one-time pad protocol is a valuable resource, to both 
the legitimate communication parties and to an eavesdropper: Alice and Bob 
use up the key during the communication. In order to supply themselves with 
a new key, they have to meet each other physically. On the other hand, if 
Eve knows the key, the communication between Alice and Bob is no longer 
a secret for her; for this reason, the cryptographic key might be a valuable 
target for theft or bribery. The aim of quantum cryptography is to solve 
this shortcoming of classical cryptography. In most quantum cryptography 
protocols, the quantum part of the protocol is related to the distribution of 
a key (quantum key distribution, QKD), which can afterwards, as soon as it 
is established, be used for a classical one-time pad protocol. 

1.4.1 The BB84 Protocol 

The first protocol for quantum key distribution was given by Bennett and 
Brassard in 1984 jl^. This so-called BB84 protocol is widely used in quantum 
cryptography, since all security considerations are well analyzed, and it is easy 
to understand. 

The protocol works as follows: Alice prepares two random binary strings, 
the key string (fci, k2, . . . , fc^r) and the basis string (6i, 62, . . . , 6Ar). The ran- 
domness of the bits is crucial for the security of the protocol; they may thus 
not be chosen by a pscudo random number generator. 

There are 4 different quantum states which Alice can prepare: |soo) = 
|0) , |.oi> = |1> , Nio) = 1+) ^ 1/V2(|0) + |1)), |,sn> = |-> ^ 1/V2(|0) - |1)). 
For simplicity, wc will now consider the case of qubits which are represented 
in the polarization degree of freedom of a photon. In this case, the four 
states which Alice can prepare are horizontally, vertically, or ±45° polarized 
photons. 

Alice sends N photons through the quantum channel to Bob. The state in 
which the qubits are prepared depends on the key- and and the basis string: 
the ith qubit is prepared in the state \sbiki)- 

Bob can measure each photon that arrives in his laboratory either in the 
|0) / |l)-basis (i.e. in the horizontal/ vertical basis), or in the |+) / |— )-basis 
(i.e. in the ±45° polarized basis). For each individual photon, he selects the 
measurement basis randomly, and he writes down the chosen basis and the 
measurement result. When Bob has received and measured the N photons, 
he is left with two strings of N bits: the "basis" string and the "result" string. 

Alice and Bob exchange their respective basis strings through a classical 
channel, which may be public; for example, they might announce the basis 
strings in a newspaper. It is no security breach if Eve knows both basis 
strings. However, Alice and Bob must make sure that Eve cannot alter these 
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messages. One possibility to achieve this goal is that Alice and Bob posses 
an initial shared secret, which can be used to check the authenticity and 
integrity of the basis strings. During the key distribution task, this initial 
shared secret can be recreated, so that it is not used up; rather, it plays the 
role of a catalyst. By comparing their basis strings, Alice and Bob can see 
which photons have been measured in the same basis in which they have 
been prepared. Whenever the preparation basis and the measurement basis 
are different. Bob's measurement result is completely random and cannot be 
used. On the other hand, if the two bases are the same, Bob's measurement 
result will be strictly correlated with Alice's key bit for the respective photon: 
Alice's key bits and Bob's measurement results for these photons can be used 
as a secret key. 

Before the key can be used, Alice and Bob have to make sure that the 
quantum channel has not been eavesdropped. One way to do this is the 
following: Alice chooses a certain number of the key bits randomly and sends 
them to Bob through the classical public channel. Bob compares Alice's key 
bits with his result bits, and if they are equal, they can be sure that there 
was no eavesdropper who tapped the quantum channel. This is due to the 
fact that the only quantum operation which does not disturb non-orthogonal 
quantum states is the identity. In other words: if Eve does not want to disturb 
the non-orthogonal quantum states which Alice sends, she has to leave them 
alone. 



1.4.2 The Ekert Protocol 

The main difference between the BB84 protocol and the so-called E91 proto- 



col found by Ekert in 1991 |11 is that it does not use single photons which 
one communication party sends to the other, but pairs of entangled photons. 
While its experimental realization is more difficult than the BB84 protocol, it 
has a theoretical advantage: the security of the E91 protocol is related to the 
fact that there exists no local realistic theory which explains the outcomes 
of Bell-type experiments]^ While in the BB84 protocol one has to believe 
that the quantum mechanical description of photons is complete (i. e. that 
there exist no (local) variables — "hidden" or not — which could be used 
to predict Bob's measurement outcome^, the E91 protocol performs a Bell 
experiment at the same time, which assures that there cannot exist (local) 
hidden variables. 



For a recent review of experiments testing Bell's inequalities, see e. g. | pl| . 
In experiments, classical information about the state which has been prepared 
might leak out of Alice's laboratory through different degrees of freedom, like 
the frequency of the photon, or the polarization of a second photon in a multi- 
photon pulse. This information could in principle be exploited by Eve without 
introducing noise. For the E91 protocol, this leakage problem does not exist, since 
such information does not exist until Alice and Bob perform their measurement. 
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In the E91 protocol, pairs of entangled photons are prepared, for exam- 
ple in the state \^^) = (|01) — |10))/V2. It does not matter whether these 
pairs are produced in Alice's or Bob's laboratory, or by a (potentially un- 
trusted) source in between. One photon of each pair is sent to Alice, the 
other to Bob. For each photon, Alice and Bob choose one out of a set of 
three measurement directions at random, and measure the polarization of 



the photon in this direction (see Fig. 1.4). As in the BB84 protocol. Eve 




Fig. 1.4. The measurement directions in the Ekert protocol. For each EPR pair, 
Alice and Bob choose independently and randomly one of the three measurement 
directions 01,02,03 and 61,62,^3, respectively. 



must not be able to predict the choice of the measurement directions. As 
soon as all pairs are sent to Alice and Bob and they acknowledge that they 
have performed the measurements, the information about the measurement 
directions is exchanged (through a public classical channel). Alice and Bob 
check for which pairs their respective measurement directions were the same; 
for all pairs where they have chosen different measurement directions, also 
the measurement outcomes are exchanged through the public classical chan- 
nel. With these results, Alice and Bob check that the Bell inequalities p^ , ^ 
are violated. The measurement results for the pairs where they have chosen 
the same measurement direction are strictly anti-correlatcd, and can be used 
as a key. 



1.4.3 Security Proofs 

As we have seen above, the quantum key distribution protocols allow for 
secure communication, as long as Alice and Bob are connected by a noise- 
less quantum channel. This is a remarkable result - however, it would be 
useless for all practical purposes, since all quantum channels are a source of 
noise. Since Alice and Bob trust only the equipment in their laboratories, 
they cannot be sure that the noise which they measure can be attributed 
to the channel. It is in principle impossible to distinguish between noise in- 
troduced by the quantum channel or by an eavesdropper. For this reason, 
the communication parties have to deal with the worst case scenario of an 
eavesdropper, who is present all the time and everywhere, except for the 
laboratories, which are secure by assumption. The eavesdropper might be 
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hidden behind the noise of the quantum channel, and she might gain partial 
knowledge of the cryptographic key and, later, of the secret message. 

The simplest way to deal with this situation would be to use a better 
quantum channel. In a practical setting, however, when Alice and Bob are 
connected by a given quantum channel (e. g. an optical fiber), this possibility 
is ruled out. In this situation, Alice and Bob can use privacy amplification 
methods, where a shorter and perfectly secure key is distilled out of a longer 
key, about which Eve might have had considerable knowledge. So-called "ul- 
timate" or "unconditional" security proofs of quantum cryptography show 
that such protocols do exist. 

The first of these proofs has been given by Mayers in 1996 for the 
BB84 protocol. Shor and Preskill gave a physical interpretation of this proof, 
as they showed that it could a posteriori be understood as a restricted, al- 
beit sufficient, form of quantum error correction and one-way entanglement 
purification. 

A different approach has been taken by Deutsch et al. in 1996 M. They 



employ a two-way entanglement purification protocol (2-EPP, see Sec. 1.3) 
in order to distill almost pure EPR pairs out of many imperfect pairs. If the 
purified pairs are used for teleportation, the resulting quantum channel is 
perfectly secure: Since the EPR pairs are in a pure state, they cannot be en- 
tangled with any other quantum system. The eavesdropper is thus "factored 
out" in the total Hilbert space, which we write symbolically as 

2-EPP 

PAlico , Bob , Eve > r ^ )aB ( I '°Eve • 



As we have already seen in Sec. 1.3.2, in a realistic setting the purification 



protocol does not converge to perfect EPR pairs, but to some more or less 
mixed state in the Hilbert space of Alice's and Bob's qubits. But that means 
that the argument given above does no longer guarantee that Eve is factored 
out: a priori, there could exist residual entanglement with Eve. 



1.5 Private Entanglement 

In the last section we have seen that entanglement purification (using noisy 
apparatus) does not per se guarantee a provably private communication chan- 
nel. Nevertheless, in this section we will show that it suffices for the creation 
of "private entanglement" , i. e. imperfect EPR pairs which are not entangled 
with an eavesdropper. Private entanglement can thereby serve as noisy but 
secure quantum channel. 

The general idea is the following. Since Alice and Bob use noisy appa- 
ratuses for the entanglement distillation process, it is clear that the pairs 
become entangled with some degree of freedom of the laboratory. However, 
we will see that the total state of the laboratory and of the (distilled) pairs 
converges to a pure state, and then the same argument holds as in the case of 
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noiseless entanglement purification: a quantum system in a pure state cannot 
be entangled with any other quantum system. In particular, Eve cannot be 
entangled with the distilled pairs. These pairs can then be used for secure, 
albeit noisy quantum teleportation. 

In our analysis it is necessary to keep track of the state of the laboratory. 
This seems to be a difficult task, since the the details of the structure of the 
laboratory arc unknown and complicated. For this reason one does usually 
not take care of these details, and describes the system of qubits on which 
the noisy apparatus acts as an open quantum system, with a master equation 
that describes their time evolution As an alternative, in the framework 
of quantum information theory, we use the concept of completely positive 
maps [|6|. 



1.5.1 The Lab Demon 

In this section, we give a simple model of a noisy laboratory, which allows us 
to keep track of its state in terms of classical variables. 

As long as one cannot "look into" the device that introduced the noise, 
there is no way to distinguish it from a different device whose action is de- 
scribed by the same positive map. For this reason, our simple noise model is 
sufficient for the proof, and we need not delve into the complicated details of 
noisy quantum devices. 

In order to keep the argument as transparent as possible, we will restrict 
our attention to the case that only Alice's laboratory is a source of noise; it 
would be easy to extend the argument to two noisy laboratories. 

Let us assume that in Alice's lab there is a little demon. The lab demon 
kicks and shakes the qubits from time to time, and is thus a source of noise. 
However, there are no other sources of noise, and even the lab demon acts 
on the qubits in a very controlled way: let us assume that the demon has a 
random number generator that generates in each time step pairs of numbers 
(/X, I/) G {0, 1, 2, 3} according to a given probability distribution /^^ (which 
obeys the normalization condition ^ /^^ = 1). The lab demon then applies 

the (unitary) error operation to the two qubits a\ and 02 , on which 



Alice acts in the entanglement purification protocol (see Section 1.3.1 ). For 
H £ {1,2,3}, the operators cr^"''' denote the Pauli matrices acting on qubit 
a,;, and ctq"'"' = I^"'^. In addition, the lab demon writes down which error 
operations he had applied to which qubits, since he will need this informtion 
later. 

Alice does not know which of the error operations have been applied to 
the qubits, and she describes the action of the demon by the average map 

3 
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The ellipsis (...) denotes other degrees of freedom, on which Alice's lab 
demon does not act (like Bob's qubits, or some quantum system in Eve's 
hands). We call the noise channel given by this equation the correlated two 
qubit Pauli channel. It includes, for special choices of the probability distri- 
bution f^i,, the one- and two-qubit depolarizing channel, and combinations 
thereof, which have been studied in the context of entanglement purification 
using imperfect apparatus in ||2^ . 

As mentioned above, we introduced the lab demon as a simplified noise 
model in order to keep track of the internal state of the lab. For that reason, 
we assume that the lab demon attaches an error flag A to each qubit. The 
error flag will represent four different values, and it is convenient to divide it 
into two classical bits. 



1.5.2 The State of the Qubits Distributed Through the Channel 




Fig. 1.5. (a) The state of A*' pairs which are distributed through the quantum 
channel is in the worst case scenario a general 2Ai'-qubit state, which might moreover 
be entangled with degrees of freedom under Eve's control, (b) After step 1, the state 
of the N pairs is a classically correlated ensemble of pure Bell states. 



In the worst case scenario, all pairs which are distributed between Alice 



and Bob have been prepared by Eve (see Fig. 1.5a. For that reason, the total 



state of all pairs is given by a general 2iV"-qubit density operator, which can 
be written in the form 



PAB 



E 



■B 



(1.11) 
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Here, {b'^/^^'^), /ij = 00, 01, 10, 11 denote the 4 Bell states associated with the 
two qubits flj and bj and j = 1, . . . , A^. Specifically, \Boo) = |^^), \Boi) = 



In general, ( 1.11 ) will be an entangled 2A^-qubit state, which might more- 
over be entangled with additional quantum systems in Eve's hands. For the 
security analysis of the entanglement purification protocol, this state is too 
complicated and cannot be handled. It would be helpful if there was no en- 
tanglement between the different pairs. Fortunately, Alice and Bob can apply 
the following protocol to the pairs, in order to handle this situation: 

Step 1: On each pair of particles {aj,bj), they apply randomly one of the 
four bi-lateral Pauli rotations cr^"^'' (g) <jI^^\ where k = 0,1,2,3. 

Step 2: Alice and Bob randomly renumber the pairs, (oj, bj) (^TrQ)! ^7r(j)) 
where tt G S{N) is a permutation which has been chosen at random. 

It is important to note that Alice and Bob deliberately discard the knowl- 
edge about which permutation and which of the Pauli rotations have been 
applied to the pairs. Obviously, they cannot force Eve to do the same thing. 
So Eve might have a better description of the state of the pairs than Alice 
and Bob. Thus the question remains whether this additional knowledge might 
help Eve. It is easy to sec that this is not the case: Eve's description of the 
qubits has to be statistically consistent with the state which Alice and Bob 
or the lab demon assign to the to qubits. As we are going to show, at the end 
of the distillation process, the lab demon knows that the pairs arc pure EPR 
pairs. Eve can thus not have more information about the pairs than the lab 
demon 

After step 1, Ahce's and Bob's knowledge about the state is summarized 
by the density operator 



PAB= J2 (1-12) 

^I1...^IJV 

which corresponds to a classically correlated ensemble of pure Bell states 



(see Fig. 1.5b. The fact that the pairs are classically correlated means that 
the order in which they appear in the numbered ensemble may have some 
pattern, which may have been imposed by Eve or by the channel itself. By 
applying step 2, the order of the pairs is "randomized"; this will prevent Eve 
from making use of any possibly pre-arranged order of the pairs, which Alice 
and Bob are meant to follow in the course of the distillation process: they 
simply ignore this order. 

The only correlation which remains is in the number of pairs which are 
in a specific Bell state. In the limit of large N, it is consistent for all relevant 
statistical predictions to describe the ensemble with the density operator 



® In fact. Eve has less information than the lab demon, because she does not know 
the results of his random number generator. 
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Pab = 




(1.13) 



For finite iV, the form of the state after step 2 is more complicated; how- 
ever, the subsequent arguments are also valid in that case. 

At this stage, Alice and Bob have to check whether the pairs are "good 
enough" for the distillation process, i. e. they have to make sure that the 
fidelity Fq of the pairs is above the purification/security threshold (which co- 
incide for all practical purposes [0). They can do this by local measurements 
on a fraction of the pairs and classical communication. 

In order to separate conceptual from technical considerations and to ob- 
tain analytical results, we will first concentrate on a toy model where all the 
pairs are either in the state \^^) or I'f'"'"). In this case, we talk about binary 
pairs. 



1.5.3 Binary Pairs 

Let us assume that Alice and Bob initially share pairs in the state 

PAB = A |<?+)^5(<Z'+| + B (1.14) 



(binary pairs) with A = \ — B > 1/2, and that the noise is of the form (1.10) 
with the restriction that the error operators consist only of the identity and 
spin flip operators: 



n f „{ai) {a2) /i -r c:\ 

Paia2... ^ 2^ JfJ-i^^fj, "i/ Paia2...^fi <J ^ . K^-'^^) 





Eq. ( 1.15 ) describes a two-hit correlated spin- flip channel. The indices 1 and 
2 indicate the source and target bit of the bilateral CNOT operation, re- 
spectively. It is straightforward to show that, using this error model in the 
2-EPP, binary pairs will be mapped onto binary pairs. 

At the beginning of the distillation process, Alice and Bob share an en- 



semble of pairs described by ( 1.14 ). In this special case, one bit suffices for 
the error flag. At this stage, all of these bits are set to zero. This reflects the 
fact that the lab demon has the same a priori knowledge about the state of 
the ensemble as Alice and Bob. 

In each puriflcation step, two of the pairs are combined. The lab demon 



first simulates the noise channel (1.15) on each pair of pairs by using the 



random number generator as described. Whenever he applies a operation 
to a qubit, he inverts the error flag of the corresponding pair. Alice and Bob 
then apply the 2-EPP to each pair of pairs; if the measurement results in 
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the last step of the protocol coincide, the source pair will be kept. Obviously, 
the error flag of that remaining pair will also depend on the error flag of the 
the target pair, i. e. the error flag of the remaining pair is a function of the 
error flags of both "parent" pairs, which we call the flag update function. In 
the case of binary pairs, the flag update function maps two bits (the error 
flags of both parents) onto one bit. In total, there exist 16 different functions 
g : {0,1}^ {Ojl}- From these, the lab demon chooses the logical AND 
function as the flag update function, i. e. the error flag of the remaining pair 
is set to "1" if and only if both parent's error flags had the value "1" . 

After each purification step, the lab demon divides all pairs into two 
subensembles, according to the value of their error flags. By a straightfor- 
ward calculation, we obtain for the coefficients Ai and Bi, which completely 
describe the state of the pairs in the subensemble with error fiag i, the fol- 
lowing recurrence relations: 



(1.16) 



A'o =^(/oo(Ao + 2AoAi) + fniBf + 2BoBi) 

+ fs{AoBi + AiBi + AoBo)) 
A[ =1 {fooAl + fnBl + fsA.Bo) 

B'o =^(/oo(So' + 2BoBi) + fn{Al + 2AoA,) 

+ fs{BoAi + BiAi + B^Ao)) 
B[ =1 {fooBf + hiAl + fsB.Ao) 
with N = (/oo + /ii)((Ao + Ai)2 + (Bo + Si)2) + 2/,(Ao + Ai)(Bo + ^i) and 

fs = foi + flO- 

Since Alice and Bob do not know the values of the error flags, they describe 
the pairs in terms of A = + and B = Bq + Bi = 1 — A as in Eq. (1.14). 
The fidelity F is thus given hy F = A. 

For the case of uncorrelated noise, the error operations arc applied inde- 
pendently and with probability fp,{fj. = 0, 1) to both qubits. This means that 
the probability distribution /^jy factorizes into /^j^ = f^ifu- In this special 
case we obtain the following expression for fixpoints of this map: 



^° "2^ /o-l ^° -2' (1.17) 

Af = 0, B^=0, Bi°° = l-Aif. 

The fixpoint of this map that is "relevant" for our discussion is defined by 
the plus sign in the expression for A^ above. It is not per se clear that a 
fixpoint is also an attractor. In fact, we find that Eq. (1.17) gives a non- 
trivial fixpoint of (1.16) for /o > 3/4, but this fixpoint is an attractor only 
for fo > = 0.77184451 M. 
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fo 



Fig. 1.6. The values of y4o,Ai, Bo, -Bi,i^ = Ao+Ai,F''°'^'^ = Ao+Bi at the fixpoint 
as a function of the noise parameter fo [^. For fo < 0.75, the values of Ai and 
Bi , as well as the values of Ao and Bo are equal, and the respective lines lie on top 
of each other. One can clearly see that for fo < 0.75, the fidelity becomes 1/2, and 
the pairs converge to the completely mixed state 1/2 (|<f'+)(<f'+| + |$+)(^+|): the 
protocol is not in the purification regime. For fo > 0.75, the maximum achievable 
fidelity increases, and approaches unity for fo ^ 1. This corresponds to the fact that 
the protocol is in the purification regime, and that it works better if the apparatus 
is more reliable. However, the fidelity is strictly smaller than unity for fo < 1. For 
the conditional fidelity p'^°^'^ = _|_ fj^^ however, the situation is different: above 
the critical value , it becomes strictly equal to unity. Since p'^°'^'^ is the fidelity 
or the pairs from the lab demon's point of view, any eavesdropper is factored out, 
and we call this regime the security regime. The regime, where the protocol purifies 
but does not provide secure EPR pairs is called intermediate regime (highlighted 
in grey). The inset shows the same graphs on a logarithmic scale. In this graph, 
one can see that the parameters Ai and Bo do not vanish only asymptotically, but 
become zero at fo — 
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To summarize, we can identify three regimes for values of the noise param- 
eter (see Fig. |l.6| ): for a high noise level, when /o < 3/4, the protocol is not 
in the purification regime. From Alice's and Bob's point of view, the protocol 
converges to the completely mixed binary state 1/2 (|tZ'+)(!f'+| + 
For a low noise level, when fo > the protocol converges to a state where 
Aq + Bi = 1 and Ai = Bq = 0. This means that all pairs in the subensemble 
are in the state 1^"''), and all pairs in the subensemble 1 are in the state 
From the lab demon's point of view, all pairs are in a pure state! For 
that reason, we will call this regime the security regime of the entanglement 
purification protocol. For 3/4 < fo < /g"*, the protocol is in the intermedi- 
ate regime. This regime is of no practical interest, since in this regime, the 
protocol converges very slowly. However, the mere existence of the interme- 
diate regime is interesting, as it shows that purification and security are not 
trivially related to each other. 

As we have already seen, the sum + Bi is a measure for the purity 
of these pairs from the lab demon's point of view. We call this sum the 
conditional fidelity F'^°'^'^, since this is the fidelity which Alice and Bob would 
assign to the pairs if they knew the values of the error flags. 

We have also evaluated (1.16) numerically in order to investigate corre- 
lated noise (see Fig. 1.7). Like in the case of uncorrelated noise, we found that 
the coefhcients Aq and Bi reach, during the distillation process, some finite 
value, while the coefficients Ai and Bq decrease exponentially fast, whenever 
the noise level is moderate. 
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Fig. 1.7. The evolution of the four parameters Ao,^i,-Bo, and Bi in the security 
regime. Note that both Ai and Bo decrease exponentially fast in the number of 
rounds. The initial fidelity was 80%, and the values of the noise parameters were 
foo = 0.8575, /oi = fw = fii = 0.0475. 



1 Quantum Communication and Decoherence 25 



The distillation process which was described in Fig. 1.2 b now looks as in 



Fig. 1.8, where the ensemble of pairs is now supplemented with an error flag 
for each pair. One can see that in the course of the distillation process, strict 
correlations are built up between the state of the pairs and the error flags 
Aj. In the asymptotic limit, each flag identifies the state of the corresponding 
pair unambigously. 
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Fig. 1.8. In the course of the distillation process, strict correlations are built up 
between the state of the pairs and the error flags Aii (a) Initially, all error flags 
are set to zero, and there exist no correlations between the states of the pairs and 
the error flags; (b) after the first distillation round, there exist weak correlations, 
(c) Finally, in the asymptotic limit, the error flags are strictly correlated with the 
states of the pairs, and each flag identifies the state of the corresponding pair 
unambigously. 



In other words, whenever the noise level is moderate, the conditional 
fidelity converges to unity: entanglement purification can be used to create 
private entanglement. 



1.5.4 Bell-Diagonal Initial States 

In the previous section we have considered the special case of binary pairs. 
For arbitrary Bell diagonal states (Eq. (1.13)) and for noise of the form (1.10), 
the results are quite similar. However, the most important difference is that 
in the general case the intermediate regime is much smaller than in the case 
of binary pairs. 

As already mentioned, in general the error flag consists of two classical 
bits. This means that the the lab demon has to use a more complicated flag 
update function than in the case of binary pairs. In this case, the flag update 
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Fig. 1.9. Typical evolution of the 16 parameters B'^ , C'^,D'^ with i,j £ {0, 1} 
under the purification protocol. As in Eq. (L.6), the coefficients A,B,C, and D 
correspond to the four Bell states which are indicated by "Phi+" , "Psi-" , "Psi+" , 
and "Phi-" on one axis. The other axis shows the error flag A £ {00,01,10,11}. 
As one can see, only the diagoal elements survive, which means that the error flag 
identifies the states of all pair unambigously. The noise parameters in this plot are 
/oo = 0.83981, foj = /,o = 0.021131 and f,j = 0.003712 for i,j G {1, 2, 3}. 



function has been found by looking at how errors are propagated during the 
course of the distillation process. The details of this calculation can be found 
in Ip. 

Since the error flag represents four different values, the lab demon divides 
all pairs into four subcnscmbles, according to the value of their error flag 
A. In each of the subensembl es t he pairs are described by a Bell diagonal 
density operator, like in Eq. (1.6), which now depends on the subensemble. 
That means, in order to completely specify the state of all four subensembles, 
we need 16 real numbers A^^ , B^^ , C'^ , D^^ with i,j e {0, 1}. 

Fig. (1.9) shows how these 16 parameters evolve under the action of the 
distillation process: If the protocol is in the security regime, only the "diago- 
nal" elements survive and are identified by unambigously by the correspond- 
ing error flag. Again, this means that from the lab demons point of view, all 
pairs are in a pure state. 

To summarize, we have found that in the entanglement distillation pro- 
cess, entanglement is redistributed in the following sense (see Fig. 1.10): in 
the beginning, there exists (unwanted) entanglement between the EPR pairs 
and the quantum channel (Eve) . The entanglement distillation process is not 
capable of creating perfect EPR pairs, since the pairs become entangled with 
the laboratories, due to uncontrolled interactions. Despite this fact. Eve is 
factored out, and all entanglement between her and the EPR pairs is lost: 
Alice and Bob succeeded in creating private entanglement and have thus a 
private, albeit noisy, quantum channel. 
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Fig. 1.10. Tlie entanglement distribution process redistributes entanglement: at 
the beginning, the EPR pairs are entangled with the communication channel, or 
maybe even with an eavesdropper. In the end, however, the remaining EPR pairs 
are only entangled with the laboratories, and the eavesdropper is factored out. 
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